Does the security configuration related to this extensibility secure pages against independent requests or just hide the menu items? I'm trying to figure out if I can use this to integrate security for a custom page with UGM groups.

In general, if you add your own site to the left hand navigation (in 6.0.0.x and before), the only thing that is protected is the visibility of that item. However, once you punch out to your custom application, you need to double check security yourself.